# Booking Package <= 1.7.32 - Unauthenticated Verification Code Bypass

- **ID:** WPSEC-2026-1381
- **Plugin:** Booking Package (`booking-package`), https://wordpress.org/plugins/booking-package/
- **Affected versions:** all versions before 1.7.33
- **Fixed in:** 1.7.33 (Update to 1.7.33 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/booking-package
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1381/

## Description

The Booking Package plugin for WordPress is vulnerable to Authentication Bypass of its e-mail and SMS verification code step in all versions up to, and including, 1.7.32, due to a completed verification not being bound to the e-mail address, phone number or calendar it was issued for, and to the verification code check having no limit on failed attempts. This makes it possible for unauthenticated attackers to make bookings or register member accounts with e-mail addresses or phone numbers they do not control, on sites that enable verification codes.

## References

- https://wpsec.com/vuln/WPSEC-2026-1381/
- https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/
- https://wordpress.org/plugins/booking-package/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1381/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.